Avideo CVE-2026-33513

WWBN AVideo versions up to 26.0. Unauthenticated remote attacker exploits the unprotected APIName=locale endpoint with path traversal payloads. No user interaction required. Default configurations are vulnerable; no special settings needed.

This represents a high-priority vulnerability that warrants immediate attention. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L) indicates network-based exploitation with low complexity requiring no privileges or user interaction, making it trivially exploitable by unauthenticated attackers. The attack is fully automatable and provides high confidentiality impact with confirmed file disclosure and code execution capabilities. While EPSS data is not provided and the vulnerability is not listed in CISA KEV, the technical characteristics (unauthenticated API, path traversal to RCE, confirmed proof-of-concept testing per the description) suggest significant real-world risk. The primary limiting factor is that full RCE requires the attacker to first place a PHP file in the tree, though existing PHP files can already be leveraged for code execution. The absence of a patch as of publication further elevates urgency, as defenders have no direct remediation path beyond workarounds or disabling the affected endpoint.

An unauthenticated attacker sends a crafted HTTP request to the vulnerable AVideo instance targeting the locale API endpoint with path traversal sequences, such as APIName=locale&param=../../../../view/about.php, causing the server to include and execute the specified PHP file. The attacker can enumerate and execute existing PHP files to disclose sensitive configuration data, database credentials, or user information, or directly execute application logic out of context. If the attacker can upload a file with PHP content through any other vector (file upload, log poisoning, etc.), they can include that file to achieve arbitrary remote code execution with the privileges of the web server process.